Something seems wrong with ktrr

[siguza]

Something seems wrong with ktrr

[Siguza]

I think what you don't see is that, for ttbr1_el1, when you change T1SZ, you also change the base address for translation.

Imagine if you had only 16-bit addresses - 14 bits for the page, and 2 bits for the page table index. That would give you a single L3 table with four entries, and under ttbr0_el1 it would be mapped like this:

- Index 0 -> 0x0000
- Index 1 -> 0x4000
- Index 2 -> 0x8000
- Index 3 -> 0xc000

And under ttbr1_el1 it would look like this:

- Index 0 -> 0xffffffffffff0000
- Index 1 -> 0xffffffffffff4000
- Index 2 -> 0xffffffffffff8000
- Index 3 -> 0xffffffffffffc000

So now when you reduce the address size to 15 bits (by adding one to T0SZ/T1SZ), with ttbr0 you just cut off the upper half of the address space:

- Index 0 -> 0x0000
- Index 1 -> 0x4000
- Index 2 -> not mapped anymore
- Index 3 -> not mapped anymore

But with ttbr1, you cut off the upper half and move the lower half to higher addresses:

- Index 0 -> 0xffffffffffff8000
- Index 1 -> 0xffffffffffffc000
- Index 2 -> not mapped anymore
- Index 3 -> not mapped anymore

So with the Spectre mitigation, in EL0 you have an address space that only has the vbar page mapped, at 0xffffffc000000000. But when you switch to EL1, that moves down to 0xffffff8000000000, because that's simply what happens when the base address of ttbr1 changes.

Hope that answers your question.

[onlinefchen]

But in your post:

They split the kernel’s address space into two ranges. The first conatining only the bare minimum >to switch between EL0 and EL1, the second containing the entire rest of the kernel.
At boot, T1SZ is set to 25, thus mapping the first range at 0xffffff8000000000 and the second >one at 0xffffffc000000000 (for comparison, the unslid kernel base is 0xfffffff007004000).

I mean here is the vbar should be the second not the first. Do we agree?